“Verify this email is yours” spam

Yesterday I got an unusual email spam. It hit my inbox on Fastmail, coming from my Google account. The spam link was embedded in the actual email address, using the plus notation that Gmail supports. On Fastmail, the link wasn’t clickable, but on Gmail it was. When I checked Gmail, the email had been moved into Spam, so I guess they were dealing with many copies of this. Surprisingly, the link is still clickable, even with the email in the Spam folder.

I thought I hadn’t received spam like this before but looking at it again, I think I did. Just once.

The email came from “Google <noreply@google.com>”, and the spammers used some online service that requires verification. They stuffed the spam link into the email address. Here’s what it looks like on Gmail:

A spam email I received. I have obscured the spam link in this ALT text:

Verify this email is yours
[my email]+~New~messages~Read-[spam link]#@
googlemail.com
This email address was recently entered to verify your email address.
You can use this code to verify that this email belongs to you.
793352
If this wasn't you, someone may have mistyped their email address. Keep this code to yourself, and no other action is needed at this moment.
The Google Accounts team

They added a “#” character at the end of the link, so the @googlemail.com part of the email would become an anchor tag. Pretty clever, pretty devious. The link goes to a 404 now, but had an image with a link yesterday.

So, be careful if you get any email verification emails. Especially if you weren’t expecting it. It’s probably spam.

A Mastodon account is an email to spammers

This morning I received a spam email where the spammer accidentally CCed everyone, instead of BCCing them. They also seemed to have spammed many people named Donncha, so hopefully none of them reply-all asking to unsubscribe.

It’s not the first time, but they included an “email address” that isn’t an email address. They used my @donncha@mastodon.ie Mastodon account. They also included my Gmail address, which is how I received the email.

A screenshot showing the text:
donncha.o
donncha.o
donncha.o
donncha@
donncha@
donncha@
donncha@
donncha@
donncha@
donncha@
donncha@
donncha@
donncha@
donncha@
donnchagi
donnchah‹
donncham

I started receiving email to this blog’s @donncha@odd.blog address and to photoblog’s @donncha@inphotos.org address too, but I’ve blocked them already.

Screenshot from Fastmail showing an email alias is disabled.

If you publish the address of your self-hosted Mastodon account, you might want to make sure you don’t have an email address there too, or you’ll start to get unwelcome emails.

BTW – you should pay for your email, especially if you have self-hosted domains. Fastmail is great. Here’s the post I wrote about Fastmail when I switched over last year.

I moved on over to Fastmail

For many years, I hosted my email here on my own server, but it was far from ideal. I used Postfix to run the server. I forwarded the email to my Gmail account using Procmail recipes. I read my email on Gmail, and sent email from there too.

That worked most of the time, but if an email had any kind of domain protection such as DKIM or SPF then Gmail was likely to reject the email and unless I was looking at /var/log/mail.log I probably wouldn’t notice. To combat that, I left a copy of every email on this server. Once I knew that email from a domain could get through to Gmail, I added a Procmail rule that forwarded it without backing it up (hint: the vast majority of domains do not have this protection). I installed mutt and learned how to use that through an ssh connection to my server, and I read those emails in a text mode application like some sort of 90’s retro hacker man. Queue up the GIF, please..

I had Postgrey installed to weed out silly attempts at spamming me, and SpamAssassin to stop everything else. It did a good job until it didn’t, and let through too many spams. Various RBLs helped, until they shut down. Then Gmail got pissed and would reject my emails until I put in place Procmail rules to filter out persistent spammers. So, I got pretty good at Procmail too. 🙂

Anyway. After all that I couldn’t send an email from any of my domains without tricking my free Gmail account into accepting email from them, but not really doing it. The details are hazy, but I was able to send from an user@example.com address. A single one per domain. That wasn’t very useful.

So, this summer, I moved my email domains over to Fastmail. The domain hosting this blog hasn’t been moved over, but the email from this server gets sent through there. It works quite well too! I can even send email from any of my wildcard email addresses. It feels wild that I can do that!

There are pretty good filtering rules that let you do all sorts of things. You can even do regular expression matching, which is handy for wildcard addresses containing a specific string. One of my domains gets a TON of spam. I used it in years past to comment on blogs, sign up on various services, and ask for feedback on websites, so it’s been indexed to death by spammers. I still use it though, and with a prefix string, it’s still useful.

In Fastmail, go to Settings->Mail rules->Create rule and then click on “Switch to no-preview rules”. I was able to set up a rule there that matched my prefix string at my domain (for example: john..*@example.com) and labelled any matching emails the way I wanted.

I created another rule using “The spam score” “is at least” 5 (which puts in the spam folder) from that domain to mark those emails read, but that didn’t work. I’ll get in touch with support and ask them about it. It seems that if an email is spammy, then no rules run on it. Boo.

Setting up DKIM and SPF records was simple. I’m thrilled with it and paid up for the next year. Imagine that, paying for email! It’s so nice that Google doesn’t know when I’m going travelling, too.

I discovered today, while digging around in the filtering rules, they have a referral program. If you join up through this Fastmail link you’ll get 10% off your first year. I should have asked someone at work for their referral link. A few people there already use them!

Edit: I contacted support about marking spam as read, for one domain, and they replied overnight. There’s a default setting to enable spam detection. You have to set that to custom, and then add a rule wherever you want spam email to be dealt with. So, if I want email from a certain domain, with a spam score higher than 5 to be marked read before marking it as spam, I can do that now, and it works nicely! Here’s what they said:

This is a result of the order in which Spam filtering and rule application is executed in. You’ll note that in the Settings ? Mail rules menu screen, from top to bottom it reads “Blocked senders, Spam protection, Rules”. This is the same order in which these checks are applied. Spam filtering is applied before mailing rules, and mailing rules are only applied to messages that are being delivered into the Inbox (and so not those marked as Spam).

That said, I can suggest a workaround that will allow you to choose when spam filtering is done. Instead of using the standard spam filter, you can convert the spam filter itself into a rule. That way you can manage it like any other rule moving it to your desired position to execute before or after or in between your rules. You can use the combination of custom spam protection and the filter rules to achieve this:

  • Go to the Settings ? Spam Protection? screen to change your Spam Protection level to “Custom”.
  • Turn off the “Move messages with a score of X or higher to Spam”.
  • Create a new rule in the Settings ? Filters & Rules? screen:
  • Click on Create Rule button.
  • Switch to no-preview rules.
  • Select The spam score (is at least) from the options and put in the number 5 (or whatever other cut-off score you desire).
  • Click Add Condition and make it A header called X-Spam-known-sender does not match glob pattern yes*.
  • Click Continue.
  • Set the action to Send to spam.
  • Give it a Name “Spam filtering” (or anything of your choice to easily identify).
  • Save.

After following these steps, your Spam filter will now just be treated like another rule. The rules in your list are again executed in the order they’re presented, from top first to bottom last, so you can drag and drop this new spam rule to control which rules execute before and after it.

Fastmail support

Spam as Gaeilge

Tá seic do chiste ($ 2.5 milliún) curtha i dtaisce againn trí roinn Western Union tar éis ár gcruinnithe deiridh maidir le do chiste. Níl le déanamh agat ach teagmháil a dhéanamh le Stiúrthóir Western Union, an Dr. Ferdinand Umeh trí sheoladh ríomhphoist, tabharfaidh sé treoracha duit maidir le conas do chiste iomlán a fháil.

“WESTERN UNION”

You’d think that after going to all the trouble to hack a mail server the spammers would realise that 99% of people in Ireland speak English and the vast majority don’t speak any Irish at all.

Gmail picked it up as spam anyway. Better luck next time.

Opt-Out of all the spam!

I’ve been getting a ton of CBD expo spam for months. Spamassassin picks up most of it, and Gmail collects the rest in the Spam folder.

However, today one got through so I scrolled down to the unsub link and saw it was sendgrid. I recognise them from previously reporting spam. I have no idea if it made a difference but I like to think it did.

So, despite the prevailing advice that you don’t unsubscribe from spam I clicked unsubscribe. I opted-out of that email, and then I saw the greyed out “View Opt Out Preferences” button.

That’s not exactly the friendliest thing to do, making it look like it isn’t active but I clicked on it and discovered a treasure trove!

This spammer has been busy, but Sendgrid allows you to unsubscribe from them all in one click.

“But Donncha, now the spammer knows your email is real!”

Yeah, it’s been inundated with spam for years already. I’m planning on shutting it down sooner or later anyway because I’ve moved most of my logins to service specific email aliases for easy tracking of spam sources. It’s paid off a couple of times too.

Your DNA results are now ready!

This was a weird email to receive since I have never sent off a DNA sample to any company.

Dear Friend,

Your DNA results are now ready!

The results of your DNA sample reveal information about your distant ancestors, including how and when they moved out of Africa and the various populations they interacted with over thousands of years of migration. We hope you enjoy exploring your chapter of the human story.

Sure enough, it’s spam from The National Geographic. The linked page allows you to buy the Geno 2.0 Next Generation kit.

I used to have an NG subscription years ago but I gave it up. I wasn’t reading it, and the issues were collecting dust in a corner. Looks like they’re harvesting their email lists. Anyone else get this email?

Irish Water Phishing Emails

I must have been half asleep when I clicked the link in this email, but Gmail hadn’t caught it yet even though it’s an obvious phishing attempt, so be warned if you get an email warning of “urgent maintenance” of your account. Then again, it’s probably a bad site to phish, since most people are boycotting them. I bet there’ll be people on Facebook complaining that they were sent these emails, even though they’re protesting it! 🙂

Screen Shot 2016-06-09 at 10.55.45

The from address is at Telefonica, and the login link goes to a page at 3i6e5.16mb.com which is a convincing Irish Water login page, looking very like the original.

Screen Shot 2016-06-09 at 10.58.40

Opening both pages in two tabs and switching between them shows no jumps in spacing or changes at all. Irish Water haven’t been around that long either so it’s not as if we’re all familiar with how they compose their email correspondence. Mark as spam and don’t let the bad guys win.

Sky obviously never check their customer surveys

Someone used my gmail address when they signed up for Sky Television. They must have lots of spare time and money to burn as they’re getting the “Variety with Sports & Movies” package at 83 Euro a month. Yikes.

I filled in the Sky customer survey a few times but they appear to have been ignored. One more time then.

Their emails aren’t really helpful, but Gmail does somehow know how to unsubscribe from Sky emails. I’ve sent Sky a reply telling them they have the wrong email for this account. Updates in the comments if I hear back from them!

You received this because you enquired about subscribing or subscribe to Sky. If you have received this email in error, please accept our apologies.

Sky Survey

Sky Survey Results

Extortion by Email Spam

Spammers are getting desperate. I received the following email a few days ago, which somehow got through Gmail’s spam filter:

From: “germes”
To: “donncha” <.....>
Subject: RE: Hello
Date: Sun, 24 Mar 2013 15:37:20 +0000

Hello You received this message because this is an email list for mass mailings. We analyze the list and remove a lot of email. pay you $ 2 or 2 euro, and we will remove it from the list of spam Email newsletters.

webMoney purse
Z180596051821
E943924283321

I presume they meant to say that I pay them to remove my email address from their mailing list rather than the other way around!

Link Exchange Spammers Are Back Again!

Well, the link spammers never really went away did they? Has anyone noticed a huge increase in the number of “link exchange” emails or is it that I’ve been added to a particularly busy spammer’s list? I just noticed that a few recent ones contained the text “emailsnomore(dot)com” so I’m going to add a gmail filter to delete any emails containing that domain. You probably should too.

Hi,

My name is Daisy Gibson, Web Marketing Consultant. Ive greatly enjoyed looking through your site ocaoimh.ie and I was wondering if you’d be interested in exchanging links with my website, which has a related subject. I can offer you a home page link back from my related websites all in google cache and backlinks which are:

shawntierney(dot)com PR4
collectiveunconsciousltd(dot)com PR3

If you are interested, please send me the following details of your site:

TITLE:
URL:

I’ll add your link as soon as possible, in the next 24 hours. As soon as it’s ready, I’ll send you a confirmation email along with the information (TITLE and URL) regarding my site to be placed at yours.

I hope you have a nice day and thank you for your time.

Kindest regards,

PLEASE NOTE THAT THIS IS NOT A SPAM OR AUTOMATED EMAIL, IT’S ONLY A REQUEST FOR A LINK EXCHANGE. YOUR EMAIL ADDRESS HAS NOT BEEN ADDED TO ANY LISTS, AND YOU WILL NOT BE CONTACTED AGAIN. IF YOU’D LIKE TO MAKE SURE WE DON’T CONTACT YOU AGAIN, PLEASE FILL IN THE FOLLOWING FORM: emailsnomore(dot)com ; PLEASE ACCEPT OUR APOLOGIES FOR CONTACTING YOU.